Microsoft Entra Permissions Management

Retirement notice

Microsoft Entra Permissions Management is retired and no longer sold or supported. Per Microsoft's end of sale and retirement announcement, sales to new Enterprise Agreement and direct customers ended on 1 April 2025 and to new CSP customers on 1 May 2025. End of support was first set for 1 October 2025; a 29 September 2025 update moved it to 1 November 2025, called the extension final, and stated that remaining customers would be auto-offboarded on that date. Microsoft published offboarding guidance for the transition.

Two features carry on in Microsoft Defender for Cloud as part of the Defender CSPM plan: permissions discovery for high-privileged identities and the Permission Creep Index for multicloud environments. For the rest of the CIEM feature set, Microsoft named Delinea as its migration partner. We keep this profile as a reference for former customers mapping their requirements to a replacement.

Overview

Microsoft Entra Permissions Management was Microsoft's cloud infrastructure entitlement management (CIEM) product, built from the 2021 CloudKnox acquisition and folded into the Entra identity family. It provided multi-cloud entitlement visibility across AWS, Azure, and GCP, with the Permission Creep Index as its headline metric for over-provisioning.

What it was good at

The core analysis was solid. It discovered identities, measured granted versus used permissions, and could right-size roles, including on-demand and time-limited permission grants. Living inside Entra was the obvious advantage for Microsoft shops: one identity control plane, familiar tooling, and unified governance alongside the rest of the suite. For Azure-centric estates, it delivered competent CIEM without adding another vendor relationship. Our support and ecosystem score now reflects the end of support rather than Microsoft's reach.

Where it fell short

Product investment felt slower than at independent CIEM specialists, the multi-cloud experience was strongest on Azure and thinner on AWS and GCP, and remediation depth lagged the dedicated vendors. There was no deep just-in-time brokering on par with specialists, and lifecycle provisioning was limited. It read as a capable add-on more than a category leader, and the retirement confirms that Microsoft chose to keep CIEM as a feature of Defender for Cloud rather than a standalone product.

Pricing

No longer available for purchase. While on sale, Microsoft published per-resource, per-month pricing billed through Azure. To budget a replacement, model your estate with the TCO calculator.

Who this profile is for now

Existing and former customers planning or completing a migration. If you only used the Permission Creep Index and high-privilege discovery and already run Defender for Cloud, check those features in the Defender CSPM plan first. For full CIEM depth, compare Microsoft's named partner Delinea with independent options such as Wiz, Sonrai Security, Tenable Cloud Security, or Britive for just-in-time access brokering. See the full CIEM category.

Bottom line

A retired product. Do not plan a new deployment around it. Former customers should confirm which features they relied on, check what Defender CSPM now covers, and move the remainder to an actively supported CIEM tool.